Recently, an efficient obfuscator of indistinguishability obfuscation was constructed by Grag et al, and it is considered as a powerful cryptographic primitive. In this paper, we propose forward secure non-interactive key exchange from indistinguishability obfuscation. A non-interactive key exchange provides an efficiency of overall system, because there are no interactions between users for key exchange. Forward security is important security requirement, because it mitigates damage when user's private key is revealed. In 2014, Pointcheval and Sanders proposed the first forward secure non- interactive key exchange scheme from multilinear map. In their scheme, there is a lifetime of a system and the lifetime is divided into time period. A user updates its private key according to time period, so the scheme has limits in the number of updates of private key. To make it free from limits of the number of updates, we design forward secure non-interactive key exchange scheme from indistinguishability obfuscation. In our scheme, there is no limits in the number of updates of private key.
Recently, an efficient obfuscator of indistinguishability obfuscation was constructed by Grag et al, and it is considered as a powerful cryptographic primitive. In this paper, we propose forward secure non-interactive key exchange from indistinguishability obfuscation. A non-interactive key exchange provides an efficiency of overall system, because there are no interactions between users for key exchange. Forward security is important security requirement, because it mitigates damage when user's private key is revealed. In 2014, Pointcheval and Sanders proposed the first forward secure non- interactive key exchange scheme from multilinear map. In their scheme, there is a lifetime of a system and the lifetime is divided into time period. A user updates its private key according to time period, so the scheme has limits in the number of updates of private key. To make it free from limits of the number of updates, we design forward secure non-interactive key exchange scheme from indistinguishability obfuscation. In our scheme, there is no limits in the number of updates of private key.
Abstract Non-interactive group key exchange is a fundamental primitive for establishing secure communication channels in multi-party settings. However, existing protocols usually rely on computationally expensive tools, such as multi-linear maps and indistinguishability obfuscation, or lack efficient support for dynamic groups. To address these limitations, we propose a secure and efficient non-interactive group key exchange protocol built upon bilinear maps, which offers the following advantages over existing solutions. First, our protocol suits well for dynamic groups by enabling non-interactive key updates to accommodate frequent membership changes. Second, it exhibits two desirable features for distributed applications: sender un-restriction, which permits any party to send a message, and recipient un-restriction, which allows a sender to select an arbitrary subset of members as recipients. Furthermore, our protocol generates constant-size ciphertexts, enhancing its efficiency and scalability. We formally prove that our protocol achieves fully collusion-resistance in the standard model under the k-Bilinear Diffie-Hellman Exponent (k-BDHE) assumption. Performance analysis confirms the protocol's practical efficiency.
Recently, Yang and Tan proposed a certificateless key exchange protocol without pairing, and claimed their scheme satisfies forward secrecy, which means no adversary could derive an already-established session key unless the full user secret keys (including a private key and an ephemeral secret key) of both communication parties are compromised. However, in this paper, we point out their protocol is actually not secure as claimed by presenting an attack launched by an adversary who has learned the private key of one party and the ephemeral secret key of the other, but not the full user secret keys of both parties. Furthermore, to make up this flaw, we also provide an improved protocol in which the private key and the ephemeral secret key are closely intertwined with each other for generating the session key, thus above attack can be efficiently resisted.
Abstract. Adaptively-secure encryption schemes ensure secrecy even in the presence of an adversary who can corrupt parties in an adaptive manner based on public keys, ciphertexts, and secret data of alreadycorrupted parties. Ideally, an adaptively-secure encryption scheme should, like standard public-key encryption, allow arbitrarily-many parties to use a single encryption key to securely encrypt arbitrarily-many messages to a given receiver who maintains only a single short decryption key. However, it is known that these requirements are impossible to achieve: no non-interactive encryption scheme that supports encryption of an unbounded number of messages and uses a single, unchanging decryption key can be adaptively secure. Impossibility holds even if secure data erasure is possible. We show that this limitation can be overcome by updating the decryption key over time and making some mild assumptions about the frequency of communication between parties. Using this approach, we construct adaptively-secure, completely non-interactive encryption schemes supporting secure encryption of arbitrarily-many messages from arbitrarilymany senders. Our schemes additionally provide forward security and security against chosen-ciphertext attacks. 1
Privacy-preserving authenticated key exchange (PPAKE) is a cryptographic protocol that enables two users to exchange a session key while protecting users' privacy (i.e., hiding the user's identity) against the machine-in-the-middle adversary. To hide user identities, PPAKE messages are broadcast to the network, increasing communication complexity. In ASIACRYPT2022, Lyu et al. introduced a concept of robustness to reduce communication complexity. Roughly, robust PPAKE allows receivers to decide whether it is the intended user by processing the first message with its long-term secret key. As a result, only the intended user replies to the first message, and thus, messages in the network are reduced. However, if a user's secret key is leaked, an adversary can also use it to determine whether the past first message was intended for the user, and thus, the PPAKE scheme of Lyu et al. does not have full forward privacy. Lyu et al. leave an open problem of constructing a PPAKE scheme with robustness and full forward privacy. In this work, we solve this problem by introducing a new framework called key updatable PPAKE (kuPPAKE). In kuPPAKE schemes, a long-term secret key is updated so that the updated key does not work for past messages. Therefore, robustness no longer conflicts with full forward privacy. We propose a generic construction of a 2-round kuPPAKE and show a concrete scheme in the standard model from DH-style assumptions over bilinear groups.
Non-interactive key exchange (NIKE) enables two or multiple parties (just knowing the public system parameters and each other's public key) to derive a (group) session key without the need for interaction. Recently, NIKE in multi-party settings has been attached importance. However, we note that most existing multi-party NIKE protocols, underlying costly cryptographic techniques (i.e., multilinear maps and indistinguishability obfuscation), lead to high computational costs once employed in practice. Therefore, it is a challenging task to achieve multi-party NIKE protocols by using more practical cryptographic primitives. In this paper, we propose a secure and efficient NIKE protocol for secure communications in dynamic groups, whose construction only bases on bilinear maps. This protocol allows multiple parties to negotiate asymmetric group keys (a public group encryption key and each party's decryption key) without any interaction among one another. Additionally, the protocol supports updating of group keys in an efficient and non-interactive way once any party outside a group or any group member joins or leaves the group. Further, any party called a sender (even outside a group) intending to connect with some or all of group members called receivers in a group, just needs to generate a ciphertext with constant size under the public group encryption key, and only the group member who is the real receiver can decrypt the ciphertext to obtain the session key. We prove our protocol captures the correctness and indistinguishability of session key under k-Bilinear Diffie-Hellman exponent (k-BDHE) assumption. Efficiency evaluation shows the efficiency of our protocol.
Abstract. Constructingaoneround group key exchange (GKE) protocol that provides forwardsecrecy is an open problem in the literature. In this paper, we investigate whether or not the security of one round GKE protocols can be enhanced with any form of forward secrecy without increasing the number of rounds. We apply the key evolving approach used for forward secure encryption/signature schemes and then model the notion of forward security for the first time for key exchange protocols. This notion is slightly weaker than forward secrecy, considered traditionally for key exchange protocols. We then revise an existing one round GKE protocol to propose a GKE protocol with forward security. In the security proof of the revised protocol we completely avoid reliance on the random oracle assumption that was needed for the proof of the base protocol. Our security proof can be directly applied to the base protocol, making it the most efficient one round GKE protocol secure in the standard model. Our one round GKE protocol is generically constructed from the primitive of forward secure encryption. We also propose a concrete forward secure encryption scheme with constant size ciphertext that can be used to efficiently instantiate our protocol.